From 750f4812caf73cbacf8a26cc9f7179898bfef8f8 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Tue, 8 Sep 2026 04:17:02 +0000 Subject: [PATCH 1/2] Patch libxml2 for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137 --- SPECS/libxml2/CVE-2026-86137.patch | 53 ++++ SPECS/libxml2/CVE-2026-86138.patch | 52 ++++ SPECS/libxml2/CVE-2026-86140.patch | 56 +++++ SPECS/libxml2/CVE-2026-86142.patch | 34 +++ SPECS/libxml2/CVE-2026-86143.patch | 58 +++++ SPECS/libxml2/CVE-2026-86144.patch | 227 ++++++++++++++++++ SPECS/libxml2/libxml2.spec | 11 +- .../manifests/package/pkggen_core_aarch64.txt | 4 +- .../manifests/package/pkggen_core_x86_64.txt | 4 +- .../manifests/package/toolchain_aarch64.txt | 8 +- .../manifests/package/toolchain_x86_64.txt | 8 +- 11 files changed, 502 insertions(+), 13 deletions(-) create mode 100644 SPECS/libxml2/CVE-2026-86137.patch create mode 100644 SPECS/libxml2/CVE-2026-86138.patch create mode 100644 SPECS/libxml2/CVE-2026-86140.patch create mode 100644 SPECS/libxml2/CVE-2026-86142.patch create mode 100644 SPECS/libxml2/CVE-2026-86143.patch create mode 100644 SPECS/libxml2/CVE-2026-86144.patch diff --git a/SPECS/libxml2/CVE-2026-86137.patch b/SPECS/libxml2/CVE-2026-86137.patch new file mode 100644 index 00000000000..d19a1cd88ca --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86137.patch @@ -0,0 +1,53 @@ +From 6a33e8e85607b3cd8552fdc5c6a2b843945e87da Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:09:39 +0000 +Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2.patch +--- + xmlregexp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index 5638ddc..e6c9da9 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -53,7 +53,9 @@ + xmlRegexpErrCompile(ctxt, str); + #define NEXT ctxt->cur++ + #define CUR (*(ctxt->cur)) +-#define NXT(index) (ctxt->cur[index]) ++#define NXT(index) \ ++ (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len) \ ++ ? ctxt->cur[index] : 0) + + #define CUR_SCHAR(s, l) xmlStringCurrentChar(NULL, s, &l) + #define NEXTL(l) ctxt->cur += l; +@@ -243,6 +245,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr; + struct _xmlAutomata { + xmlChar *string; + xmlChar *cur; ++ size_t len; + + int error; + int neg; +@@ -715,8 +718,14 @@ xmlRegNewParserCtxt(const xmlChar *string) { + if (ret == NULL) + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); +- if (string != NULL) ++ if (string != NULL) { + ret->string = xmlStrdup(string); ++ ret->len = strlen((const char *) ret->string); ++ if (ret->string == NULL) { ++ xmlFree(ret); ++ return(NULL); ++ } ++ } + ret->cur = ret->string; + ret->neg = 0; + ret->negs = 0; +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86138.patch b/SPECS/libxml2/CVE-2026-86138.patch new file mode 100644 index 00000000000..526bd6df571 --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86138.patch @@ -0,0 +1,52 @@ +From ce5dfc1854ab06a9c645c51b8dc38118117bff85 Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:24 +0200 +Subject: [PATCH] fix: add overflow checks to xmlDictAddQString in dict.c + +xmlDictAddString has overflow guards for pool size calculations, but its +sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1 +addition can overflow unsigned int, and 4 * (overflowed_value) produces +a small allocation, leading to heap buffer overflow when memcpy writes +the prefix and name. + +Add the same SIZE_MAX-based overflow guards and safe size_t cast. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4.patch +--- + dict.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/dict.c b/dict.c +index d7fd1a0..8f3fe49 100644 +--- a/dict.c ++++ b/dict.c +@@ -312,10 +312,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen, + return(NULL); + } + +- if (size == 0) size = 1000; +- else size *= 4; /* exponential growth */ +- if (size < 4 * (namelen + plen + 1)) +- size = 4 * (namelen + plen + 1); /* just in case ! */ ++ if (size == 0) { ++ size = 1000; ++ } else { ++ if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size *= 4; /* exponential growth */ ++ else ++ size = SIZE_MAX - sizeof(xmlDictStrings); ++ } ++ if (size / 4 < namelen + plen + 1) { ++ if ((size_t) namelen + plen + 1 < ++ (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */ ++ else ++ return(NULL); ++ } + pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size); + if (pool == NULL) + return(NULL); +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86140.patch b/SPECS/libxml2/CVE-2026-86140.patch new file mode 100644 index 00000000000..20e3667a08a --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86140.patch @@ -0,0 +1,56 @@ +From 50ed1dfde2961a81ccbeeff108a916aef047e7ba Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:37 +0200 +Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c + +CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat() +writes, but the sibling function xmlSnprintfElements has the identical +unfixed pattern. The strcat(buf, "(") before the while loop and +strcat(buf, ")") after the loop exit have no bounds checks. + +Add remaining-space checks before both strcat calls, with early return +and ellipsis when space is insufficient. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340.patch +--- + valid.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/valid.c b/valid.c +index b0e25ae..e2f611d 100644 +--- a/valid.c ++++ b/valid.c +@@ -5242,7 +5242,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + int len; + + if (node == NULL) return; +- if (glob) strcat(buf, "("); ++ len = strlen(buf); ++ if (glob) { ++ if (size - len < 50) { ++ if ((size - len > 4) && (buf[len - 1] != '.')) ++ strcat(buf, " ..."); ++ return; ++ } ++ strcat(buf, "("); ++ } + cur = node; + while (cur != NULL) { + len = strlen(buf); +@@ -5306,7 +5314,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + } + cur = cur->next; + } +- if (glob) strcat(buf, ")"); ++ if (glob) { ++ len = strlen(buf); ++ if (size - len > 1) ++ strcat(buf, ")"); ++ } + } + + /** +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86142.patch b/SPECS/libxml2/CVE-2026-86142.patch new file mode 100644 index 00000000000..3649cd0f67b --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86142.patch @@ -0,0 +1,34 @@ +From a78f4e25fa14687e76eb817f7b37b49910b36958 Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:32:43 +0200 +Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58.patch +--- + xpointer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/xpointer.c b/xpointer.c +index d8c18d7..f82faf4 100644 +--- a/xpointer.c ++++ b/xpointer.c +@@ -968,6 +968,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { + level = 1; + + len = xmlStrlen(ctxt->cur); ++ /* Overflow in xmlStrlen */ ++ if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) { ++ xmlXPathPErrMemory(ctxt); ++ xmlFree(name); ++ return; ++ } ++ + len++; + buffer = (xmlChar *) xmlMallocAtomic(len); + if (buffer == NULL) { +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86143.patch b/SPECS/libxml2/CVE-2026-86143.patch new file mode 100644 index 00000000000..94ed463a52d --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86143.patch @@ -0,0 +1,58 @@ +From cc724cfa159923bda65bb5c8ddcd50945ab23366 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:09:34 +0000 +Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35.patch +--- + xmlIO.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/xmlIO.c b/xmlIO.c +index 5cab16f..64621dc 100644 +--- a/xmlIO.c ++++ b/xmlIO.c +@@ -3354,6 +3354,11 @@ xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) { + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } ++ + /* + * second write the stuff to the I/O channel + */ +@@ -3651,15 +3656,25 @@ xmlOutputBufferFlush(xmlOutputBufferPtr out) { + */ + if ((out->conv != NULL) && (out->encoder != NULL) && + (out->writecallback != NULL)) { ++ size_t bufsize = xmlBufUse(out->conv); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->conv), +- xmlBufUse(out->conv)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->conv, ret); + } else if (out->writecallback != NULL) { ++ size_t bufsize = xmlBufUse(out->buffer); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->buffer), +- xmlBufUse(out->buffer)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->buffer, ret); + } +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86144.patch b/SPECS/libxml2/CVE-2026-86144.patch new file mode 100644 index 00000000000..eb23fad3e0f --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86144.patch @@ -0,0 +1,227 @@ +From 61f493e4b736754cdcff5e502a9e5661806734e0 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:10:03 +0000 +Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and + xmlXIncludeProcessTree + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61.patch +--- + result/XInclude/issue1120-1.xml | 4 ++ + result/XInclude/issue1120-1.xml.err | 1 + + result/XInclude/issue1120-2.xml | 4 ++ + result/XInclude/issue1120-2.xml.err | 1 + + runtest.c | 76 +++++++++++++++++++++++++ + test/XInclude/issue1120/issue1120-1.xml | 6 ++ + test/XInclude/issue1120/issue1120-2.xml | 6 ++ + xinclude.c | 20 ++++++- + 8 files changed, 115 insertions(+), 3 deletions(-) + create mode 100644 result/XInclude/issue1120-1.xml + create mode 100644 result/XInclude/issue1120-1.xml.err + create mode 100644 result/XInclude/issue1120-2.xml + create mode 100644 result/XInclude/issue1120-2.xml.err + create mode 100644 test/XInclude/issue1120/issue1120-1.xml + create mode 100644 test/XInclude/issue1120/issue1120-2.xml + +diff --git a/result/XInclude/issue1120-1.xml b/result/XInclude/issue1120-1.xml +new file mode 100644 +index 0000000..5d83cc9 +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml +@@ -0,0 +1,4 @@ ++ ++ ++ Network access is not allowed ++ +diff --git a/result/XInclude/issue1120-1.xml.err b/result/XInclude/issue1120-1.xml.err +new file mode 100644 +index 0000000..c134bed +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml.err +@@ -0,0 +1 @@ ++I/O error : failed to load "http://example.invalid/file.txt": Attempt to load network entity +diff --git a/result/XInclude/issue1120-2.xml b/result/XInclude/issue1120-2.xml +new file mode 100644 +index 0000000..af5bde9 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml +@@ -0,0 +1,4 @@ ++ ++ ++

Network access is not allowed

++ +diff --git a/result/XInclude/issue1120-2.xml.err b/result/XInclude/issue1120-2.xml.err +new file mode 100644 +index 0000000..051f592 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml.err +@@ -0,0 +1 @@ ++I/O error : failed to load "http://example.invalid/file.xml": Attempt to load network entity +diff --git a/runtest.c b/runtest.c +index 7060603..39659a7 100644 +--- a/runtest.c ++++ b/runtest.c +@@ -2397,6 +2397,76 @@ noentParseTest(const char *filename, const char *result, + return(res); + } + ++ ++#ifdef LIBXML_XINCLUDE_ENABLED ++/** ++ * Parse a file and run xmlXIncludeProcess() to verify that doc->parseFlags ++ * is propagated properly. ++ * ++ * @param filename the file to parse ++ * @param result the file with expected result ++ * @param err the file with error messages ++ * @returns 0 in case of success, an error code otherwise ++ */ ++static int ++xincludeProcessTest(const char *filename, const char *result, const char *err, ++ int options) { ++ xmlParserCtxtPtr ctxt; ++ xmlDocPtr doc; ++ const char *base = NULL; ++ int size, res; ++ int ret = 0; ++ ++ nb_tests++; ++ ++ /* Create a new parser context */ ++ ctxt = xmlNewParserCtxt(); ++ if (ctxt == NULL) ++ return(-1); ++ ++ /* Load the data from `filename` into a parser context */ ++ xmlCtxtSetErrorHandler(ctxt, testStructuredErrorHandler, NULL); ++ doc = xmlCtxtReadFile(ctxt, filename, NULL, options); ++ xmlFreeParserCtxt(ctxt); ++ ++ /* Check if `doc` was created successfully */ ++ if (doc == NULL) { ++ testErrorHandler(NULL, "%s : failed to parse\n", filename); ++ return(-1); ++ } ++ ++ /* ++ * Run xmlXIncludeProcess() with a structured error handler to check that ++ * the parse flags are propagated. ++ */ ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ xmlXIncludeProcess(doc); ++ xmlSetStructuredErrorFunc(NULL, NULL); ++ ++ /* Check the result and for any errors */ ++ if (result) { ++ xmlDocDumpMemory(doc, (xmlChar **) &base, &size); ++ res = compareFileMem(result, base, size); ++ xmlFree((char *) base); ++ if (res != 0) { ++ fprintf(stderr, "Result for %s failed in %s\n", filename, result); ++ ret = -1; ++ } ++ } ++ ++ if ((ret == 0) && (err != NULL)) { ++ res = compareFileMem(err, testErrors, testErrorsSize); ++ if (res != 0) { ++ fprintf(stderr, "Error for %s failed\n", filename); ++ ret = -1; ++ } ++ } ++ ++ xmlFreeDoc(doc); ++ return(ret); ++} ++#endif ++ + /** + * errParseTest: + * @filename: the file to parse +@@ -5107,6 +5177,12 @@ testDesc testDescriptions[] = { + { "XInclude regression tests without reader", + errParseTest, "./test/XInclude/without-reader/*", "result/XInclude/", "", + ".err", XML_PARSE_XINCLUDE }, ++ { "XInclude issue1120 regression tests", ++ errParseTest, "./test/XInclude/issue1120/*", "result/XInclude/", "", ++ ".err", XML_PARSE_XINCLUDE | XML_PARSE_NONET }, ++ { "XInclude xmlXIncludeProcess() issue1120 regression tests", ++ xincludeProcessTest, "./test/XInclude/issue1120/*", "result/XInclude/", ++ "", ".err", XML_PARSE_NONET }, + #endif + #ifdef LIBXML_XPATH_ENABLED + #ifdef LIBXML_DEBUG_ENABLED +diff --git a/test/XInclude/issue1120/issue1120-1.xml b/test/XInclude/issue1120/issue1120-1.xml +new file mode 100644 +index 0000000..b0b8fee +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-1.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++ Network access is not allowed ++ ++ +diff --git a/test/XInclude/issue1120/issue1120-2.xml b/test/XInclude/issue1120/issue1120-2.xml +new file mode 100644 +index 0000000..b4c9fe5 +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-2.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++

Network access is not allowed

 ++ ++ +diff --git a/xinclude.c b/xinclude.c +index 09c1eef..1aefeea 100644 +--- a/xinclude.c ++++ b/xinclude.c +@@ -1721,9 +1721,23 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, + * Load it. + */ + pctxt = xmlNewParserCtxt(); ++ if (pctxt == NULL) ++ goto error; ++ ++ xmlCtxtUseOptions(pctxt, ctxt->parseFlags); ++ + inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt); +- if(inputStream == NULL) ++ if (inputStream == NULL) { ++ if (pctxt->lastError.code == XML_ERR_NO_MEMORY) ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); ++ else if ((pctxt->lastError.code != XML_ERR_OK) && ++ (pctxt->lastError.code != XML_IO_ENOENT) && ++ (pctxt->lastError.code != XML_IO_UNKNOWN) && ++ (pctxt->lastError.code != XML_IO_NETWORK_ATTEMPT)) ++ xmlXIncludeErr(ctxt, ref->elem, pctxt->lastError.code, ++ "load error", NULL); + goto error; ++ } + buf = inputStream->buf; + if (buf == NULL) + goto error; +@@ -2438,7 +2452,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { + */ + int + xmlXIncludeProcess(xmlDocPtr doc) { +- return(xmlXIncludeProcessFlags(doc, 0)); ++ return(xmlXIncludeProcessFlags(doc, doc ? doc->parseFlags : 0)); + } + + /** +@@ -2483,7 +2497,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { + */ + int + xmlXIncludeProcessTree(xmlNodePtr tree) { +- return(xmlXIncludeProcessTreeFlags(tree, 0)); ++ return(xmlXIncludeProcessTreeFlags(tree, (tree && tree->doc) ? tree->doc->parseFlags : 0)); + } + + /** +-- +2.45.4 + diff --git a/SPECS/libxml2/libxml2.spec b/SPECS/libxml2/libxml2.spec index bf5b0a818f9..016849fb304 100644 --- a/SPECS/libxml2/libxml2.spec +++ b/SPECS/libxml2/libxml2.spec @@ -1,7 +1,7 @@ Summary: Libxml2 Name: libxml2 Version: 2.11.5 -Release: 10%{?dist} +Release: 11%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -26,6 +26,12 @@ Patch14: CVE-2026-0990.patch Patch15: CVE-2026-0992.patch Patch16: CVE-2025-8732.patch Patch17: CVE-2026-0989.patch +Patch18: CVE-2026-86137.patch +Patch19: CVE-2026-86138.patch +Patch20: CVE-2026-86140.patch +Patch21: CVE-2026-86142.patch +Patch22: CVE-2026-86143.patch +Patch23: CVE-2026-86144.patch BuildRequires: python3-devel BuildRequires: python3-xml @@ -97,6 +103,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_libdir}/cmake/libxml2/libxml2-config.cmake %changelog +* Tue Sep 08 2026 Azure Linux Security Servicing Account - 2.11.5-11 +- Patch for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137 + * Tue Mar 17 2026 Vijayender Putta - 2.11.5-10 - Patch for CVE-2026-0989 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 09fe722729c..cbb7444b34a 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -203,8 +203,8 @@ curl-8.11.1-11.azl3.aarch64.rpm curl-devel-8.11.1-11.azl3.aarch64.rpm curl-libs-8.11.1-11.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm -libxml2-2.11.5-10.azl3.aarch64.rpm -libxml2-devel-2.11.5-10.azl3.aarch64.rpm +libxml2-2.11.5-11.azl3.aarch64.rpm +libxml2-devel-2.11.5-11.azl3.aarch64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 159bbd8a09d..e9239c5f228 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -203,8 +203,8 @@ curl-8.11.1-11.azl3.x86_64.rpm curl-devel-8.11.1-11.azl3.x86_64.rpm curl-libs-8.11.1-11.azl3.x86_64.rpm createrepo_c-1.0.3-1.azl3.x86_64.rpm -libxml2-2.11.5-10.azl3.x86_64.rpm -libxml2-devel-2.11.5-10.azl3.x86_64.rpm +libxml2-2.11.5-11.azl3.x86_64.rpm +libxml2-devel-2.11.5-11.azl3.x86_64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index a6f44bef434..a9f102a59e5 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -242,9 +242,9 @@ libtool-debuginfo-2.4.7-2.azl3.aarch64.rpm libxcrypt-4.4.36-2.azl3.aarch64.rpm libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm -libxml2-2.11.5-10.azl3.aarch64.rpm -libxml2-debuginfo-2.11.5-10.azl3.aarch64.rpm -libxml2-devel-2.11.5-10.azl3.aarch64.rpm +libxml2-2.11.5-11.azl3.aarch64.rpm +libxml2-debuginfo-2.11.5-11.azl3.aarch64.rpm +libxml2-devel-2.11.5-11.azl3.aarch64.rpm libxslt-1.1.43-3.azl3.aarch64.rpm libxslt-debuginfo-1.1.43-3.azl3.aarch64.rpm libxslt-devel-1.1.43-3.azl3.aarch64.rpm @@ -544,7 +544,7 @@ python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm python3-libmount-2.40.2-5.azl3.aarch64.rpm python3-libs-3.12.14-1.azl3.aarch64.rpm -python3-libxml2-2.11.5-10.azl3.aarch64.rpm +python3-libxml2-2.11.5-11.azl3.aarch64.rpm python3-lxml-4.9.3-3.azl3.aarch64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index d39ca5ba99a..530248dd181 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -247,9 +247,9 @@ libtasn1-debuginfo-4.19.0-3.azl3.x86_64.rpm libtasn1-devel-4.19.0-3.azl3.x86_64.rpm libtool-2.4.7-2.azl3.x86_64.rpm libtool-debuginfo-2.4.7-2.azl3.x86_64.rpm -libxml2-2.11.5-10.azl3.x86_64.rpm -libxml2-debuginfo-2.11.5-10.azl3.x86_64.rpm -libxml2-devel-2.11.5-10.azl3.x86_64.rpm +libxml2-2.11.5-11.azl3.x86_64.rpm +libxml2-debuginfo-2.11.5-11.azl3.x86_64.rpm +libxml2-devel-2.11.5-11.azl3.x86_64.rpm libxcrypt-4.4.36-2.azl3.x86_64.rpm libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm @@ -552,7 +552,7 @@ python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm python3-libmount-2.40.2-5.azl3.x86_64.rpm python3-libs-3.12.14-1.azl3.x86_64.rpm -python3-libxml2-2.11.5-10.azl3.x86_64.rpm +python3-libxml2-2.11.5-11.azl3.x86_64.rpm python3-lxml-4.9.3-3.azl3.x86_64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.x86_64.rpm From 50c3706b99922e7f072d67faeec204c4172febb6 Mon Sep 17 00:00:00 2001 From: Swapnil Sahu Date: Thu, 10 Sep 2026 04:12:51 +0000 Subject: [PATCH 2/2] Update AI-generated patch --- SPECS/libxml2/CVE-2026-86142.patch | 36 +++++- SPECS/libxml2/CVE-2026-86144.patch | 181 ++--------------------------- 2 files changed, 41 insertions(+), 176 deletions(-) diff --git a/SPECS/libxml2/CVE-2026-86142.patch b/SPECS/libxml2/CVE-2026-86142.patch index 3649cd0f67b..ca3220dfce4 100644 --- a/SPECS/libxml2/CVE-2026-86142.patch +++ b/SPECS/libxml2/CVE-2026-86142.patch @@ -8,11 +8,39 @@ Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58.patch --- - xpointer.c | 7 +++++++ - 1 file changed, 7 insertions(+) + include/private/xpath.h | 4 ++++ + xpath.c | 2 +- + xpointer.c | 7 +++++++ + 3 files changed, 12 insertions(+), 1 deletion(-) +diff --git a/include/private/xpath.h b/include/private/xpath.h +index 0e8d752..0a843c6 100644 +--- a/include/private/xpath.h ++++ b/include/private/xpath.h +@@ -4,4 +4,8 @@ + XML_HIDDEN void + xmlInitXPathInternal(void); + ++#ifdef LIBXML_XPATH_ENABLED ++XML_HIDDEN void ++xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra); ++#endif + #endif /* XML_XPATH_H_PRIVATE__ */ +diff --git a/xpath.c b/xpath.c +index 8df7974..2a13d21 100644 +--- a/xpath.c ++++ b/xpath.c +@@ -683,7 +683,7 @@ xmlXPathErrMemory(xmlXPathContextPtr ctxt, const char *extra) + * + * Handle a redefinition of attribute error + */ +-static void ++void + xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra) + { + if (ctxt == NULL) diff --git a/xpointer.c b/xpointer.c -index d8c18d7..f82faf4 100644 +index d8c18d7..f8dcc7d 100644 --- a/xpointer.c +++ b/xpointer.c @@ -968,6 +968,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { @@ -21,7 +49,7 @@ index d8c18d7..f82faf4 100644 len = xmlStrlen(ctxt->cur); + /* Overflow in xmlStrlen */ + if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) { -+ xmlXPathPErrMemory(ctxt); ++ xmlXPathPErrMemory(ctxt, NULL); + xmlFree(name); + return; + } diff --git a/SPECS/libxml2/CVE-2026-86144.patch b/SPECS/libxml2/CVE-2026-86144.patch index eb23fad3e0f..5809406e76e 100644 --- a/SPECS/libxml2/CVE-2026-86144.patch +++ b/SPECS/libxml2/CVE-2026-86144.patch @@ -7,184 +7,21 @@ Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61.patch --- - result/XInclude/issue1120-1.xml | 4 ++ - result/XInclude/issue1120-1.xml.err | 1 + - result/XInclude/issue1120-2.xml | 4 ++ - result/XInclude/issue1120-2.xml.err | 1 + - runtest.c | 76 +++++++++++++++++++++++++ - test/XInclude/issue1120/issue1120-1.xml | 6 ++ - test/XInclude/issue1120/issue1120-2.xml | 6 ++ - xinclude.c | 20 ++++++- - 8 files changed, 115 insertions(+), 3 deletions(-) - create mode 100644 result/XInclude/issue1120-1.xml - create mode 100644 result/XInclude/issue1120-1.xml.err - create mode 100644 result/XInclude/issue1120-2.xml - create mode 100644 result/XInclude/issue1120-2.xml.err - create mode 100644 test/XInclude/issue1120/issue1120-1.xml - create mode 100644 test/XInclude/issue1120/issue1120-2.xml + xinclude.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) -diff --git a/result/XInclude/issue1120-1.xml b/result/XInclude/issue1120-1.xml -new file mode 100644 -index 0000000..5d83cc9 ---- /dev/null -+++ b/result/XInclude/issue1120-1.xml -@@ -0,0 +1,4 @@ -+ -+ -+ Network access is not allowed -+ -diff --git a/result/XInclude/issue1120-1.xml.err b/result/XInclude/issue1120-1.xml.err -new file mode 100644 -index 0000000..c134bed ---- /dev/null -+++ b/result/XInclude/issue1120-1.xml.err -@@ -0,0 +1 @@ -+I/O error : failed to load "http://example.invalid/file.txt": Attempt to load network entity -diff --git a/result/XInclude/issue1120-2.xml b/result/XInclude/issue1120-2.xml -new file mode 100644 -index 0000000..af5bde9 ---- /dev/null -+++ b/result/XInclude/issue1120-2.xml -@@ -0,0 +1,4 @@ -+ -+ -+

Network access is not allowed

-+ -diff --git a/result/XInclude/issue1120-2.xml.err b/result/XInclude/issue1120-2.xml.err -new file mode 100644 -index 0000000..051f592 ---- /dev/null -+++ b/result/XInclude/issue1120-2.xml.err -@@ -0,0 +1 @@ -+I/O error : failed to load "http://example.invalid/file.xml": Attempt to load network entity -diff --git a/runtest.c b/runtest.c -index 7060603..39659a7 100644 ---- a/runtest.c -+++ b/runtest.c -@@ -2397,6 +2397,76 @@ noentParseTest(const char *filename, const char *result, - return(res); - } - -+ -+#ifdef LIBXML_XINCLUDE_ENABLED -+/** -+ * Parse a file and run xmlXIncludeProcess() to verify that doc->parseFlags -+ * is propagated properly. -+ * -+ * @param filename the file to parse -+ * @param result the file with expected result -+ * @param err the file with error messages -+ * @returns 0 in case of success, an error code otherwise -+ */ -+static int -+xincludeProcessTest(const char *filename, const char *result, const char *err, -+ int options) { -+ xmlParserCtxtPtr ctxt; -+ xmlDocPtr doc; -+ const char *base = NULL; -+ int size, res; -+ int ret = 0; -+ -+ nb_tests++; -+ -+ /* Create a new parser context */ -+ ctxt = xmlNewParserCtxt(); -+ if (ctxt == NULL) -+ return(-1); -+ -+ /* Load the data from `filename` into a parser context */ -+ xmlCtxtSetErrorHandler(ctxt, testStructuredErrorHandler, NULL); -+ doc = xmlCtxtReadFile(ctxt, filename, NULL, options); -+ xmlFreeParserCtxt(ctxt); -+ -+ /* Check if `doc` was created successfully */ -+ if (doc == NULL) { -+ testErrorHandler(NULL, "%s : failed to parse\n", filename); -+ return(-1); -+ } -+ -+ /* -+ * Run xmlXIncludeProcess() with a structured error handler to check that -+ * the parse flags are propagated. -+ */ -+ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); -+ xmlXIncludeProcess(doc); -+ xmlSetStructuredErrorFunc(NULL, NULL); -+ -+ /* Check the result and for any errors */ -+ if (result) { -+ xmlDocDumpMemory(doc, (xmlChar **) &base, &size); -+ res = compareFileMem(result, base, size); -+ xmlFree((char *) base); -+ if (res != 0) { -+ fprintf(stderr, "Result for %s failed in %s\n", filename, result); -+ ret = -1; -+ } -+ } -+ -+ if ((ret == 0) && (err != NULL)) { -+ res = compareFileMem(err, testErrors, testErrorsSize); -+ if (res != 0) { -+ fprintf(stderr, "Error for %s failed\n", filename); -+ ret = -1; -+ } -+ } -+ -+ xmlFreeDoc(doc); -+ return(ret); -+} -+#endif -+ - /** - * errParseTest: - * @filename: the file to parse -@@ -5107,6 +5177,12 @@ testDesc testDescriptions[] = { - { "XInclude regression tests without reader", - errParseTest, "./test/XInclude/without-reader/*", "result/XInclude/", "", - ".err", XML_PARSE_XINCLUDE }, -+ { "XInclude issue1120 regression tests", -+ errParseTest, "./test/XInclude/issue1120/*", "result/XInclude/", "", -+ ".err", XML_PARSE_XINCLUDE | XML_PARSE_NONET }, -+ { "XInclude xmlXIncludeProcess() issue1120 regression tests", -+ xincludeProcessTest, "./test/XInclude/issue1120/*", "result/XInclude/", -+ "", ".err", XML_PARSE_NONET }, - #endif - #ifdef LIBXML_XPATH_ENABLED - #ifdef LIBXML_DEBUG_ENABLED -diff --git a/test/XInclude/issue1120/issue1120-1.xml b/test/XInclude/issue1120/issue1120-1.xml -new file mode 100644 -index 0000000..b0b8fee ---- /dev/null -+++ b/test/XInclude/issue1120/issue1120-1.xml -@@ -0,0 +1,6 @@ -+ -+ -+ -+ Network access is not allowed -+ -+ -diff --git a/test/XInclude/issue1120/issue1120-2.xml b/test/XInclude/issue1120/issue1120-2.xml -new file mode 100644 -index 0000000..b4c9fe5 ---- /dev/null -+++ b/test/XInclude/issue1120/issue1120-2.xml -@@ -0,0 +1,6 @@ -+ -+ -+ -+

Network access is not allowed

 -+ -+ diff --git a/xinclude.c b/xinclude.c -index 09c1eef..1aefeea 100644 +index 09c1eef..df254b0 100644 --- a/xinclude.c +++ b/xinclude.c -@@ -1721,9 +1721,23 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, +@@ -1721,9 +1721,25 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, * Load it. */ pctxt = xmlNewParserCtxt(); -+ if (pctxt == NULL) ++ if (pctxt == NULL) { ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); + goto error; ++ } + + xmlCtxtUseOptions(pctxt, ctxt->parseFlags); + @@ -204,7 +41,7 @@ index 09c1eef..1aefeea 100644 buf = inputStream->buf; if (buf == NULL) goto error; -@@ -2438,7 +2452,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { +@@ -2438,7 +2454,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { */ int xmlXIncludeProcess(xmlDocPtr doc) { @@ -213,7 +50,7 @@ index 09c1eef..1aefeea 100644 } /** -@@ -2483,7 +2497,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { +@@ -2483,7 +2499,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { */ int xmlXIncludeProcessTree(xmlNodePtr tree) {